CLAIMS 



What is claimed is: 



1 1. A computer program product for backtracing network performance, the 

2 computer program product comprising a computer usable medium having 

3 computer readable code thereon, including program code comprising: 

4 instructions for causing a processor to perform as a web monitor, said web 

5 monitor capturing a source address of a packet received from a network, said web 

6 monitor performing a network backtrace on said source address; and 

7 instructions for causing a processor to perform as a client, said client 

8 collecting and processing data resulting from said network backtrace, said client 

9 presenting results of said processing. 

1 2. The computer program product of claim 1 further comprising instructions 

2 for causing a processor to access a database, said database storing data captured 

3 by said web monitor 

1 3. The computer program product of claim 1 further comprising instructions 

2 for causing said client to perform a reporting function. 

1 4. The computer program product of claim 1 further comprising instructions 

2 for causing said client to perform an administrative function. 

1 5. The computer program product of claim 1 wherein said backtrace extends 

2 to a system selected from the group consisting of an end-user machine, a firewall 

3 and a router. 
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1 6. The computer program product of claim 1 further comprising instructions 

2 for causing a processor to capture a plurality of packets, for identifying SYN 

3 packets within said plurality of packets, for extracting source addresses from said 

4 SYN packets, and for extracting destination addresses from said SYN packets. 

1 7. The computer program product of claim 6 further comprising instructions 

2 for causing said monitor to trace the network routes back to said captured source 

3 address. 

1 8. The computer program product of claim 6 further comprising instructions 

2 for causing said monitor to observe the performance of the network on the path 

3 from said source address to said client. 

1 9. The computer program product of claim 1 further comprising instructions 

2 for causing said product for backtracing network performance to include a 

3 plurality of intervals. 

1 10. The computer program product of claim 9 wherein one of said intervals 

2 comprises a write interval. 

1 11. The computer program product of claim 9 wherein one of said intervals 

2 comprises a trace interval. 

1 12. The computer program product of claim 9 wherein one of said intervals 

2 comprises a prune interval. 
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1 13. The computer program product of claim 1 0 wherein when a user address 

2 is new within a write interval said user address is processed as a new user address, 

3 and when a user address has already occurred within a write interval a user 

4 request counter is incremented. 

1 14. The computer program product of claim 10 wherein each new address 

2 within a write interval is time-stamped. 

1 15. The computer program product of claim 11 wherein the first time a 

2 particular address is captured within a trace interval a traceroute operation is run 

3 on said address. 

1 16. A method of backtracing network performance comprising the steps of: 

2 capturing a source address of a packet received from a network; 

3 performing a network backtrace on said source address; 

4 collecting and processing data resulting from said network backtrace; and 

5 presenting results of said collecting and processing. 

1 17. The method of claim 16 further comprising the step of accessing a 

2 database, said database storing data captured by said backtrace. 

1 18. The method of claim 16 further comprising the step of performing a 

2 reporting function. 

1 19. The method of claim 16 further comprising performing an administrative 

2 function. 
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20. The method of claim 16 wherein said backtrace extends to a system 
selected from the group consisting of an end-user machine, a firewall and a router. 



1 21. The method of claim 1 6 further comprising the steps of: 

2 capturing a plurality of packets; 

3 identifying SYN packets within said plurality of packets; 

4 extracting source addresses from said SYN packets; and 

5 extracting destination addresses from said SYN packets. 

1 22. The method of claim 21 further comprising the step of tracing the network 

2 routes back to said captured source address. 

1 23. The method of claim 21 further comprising the step of observing the 

2 performance of the network on the path from said source address to said client. 

1 24. The method of claim 1 6 wherein when a user address is new within a write 

2 interval said user address is processed as a new user address, and when a user 

3 address has already occurred within a write interval a user request counter is 

4 incremented. 

1 25. The method of claim 10 wherein each new address within a write interval 

2 is time-stamped. 

1 26. The method of claim 16 wherein the first time a particular address is 

2 captured within a trace interval a traceroute operation is run on said address. 
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